Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership HijackOpen the advisoryOct 12, 2026
- MediumV8 API Relationship Delete Bypasses Object-Level Authorization on the Related RecordOpen the advisoryOct 12, 2026
- High7.1Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)Open the advisoryOct 12, 2026
- High8.8Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)Open the advisoryOct 12, 2026
- MediumV8 OAuth2 Username EnumerationOpen the advisoryOct 12, 2026
- CriticalAdmin OS RCE via Dropdown Editor PHP InjectionOpen the advisoryOct 12, 2026
- Critical9.9LFI to RCE via AOW_WorkFlowOpen the advisoryAug 17, 2026
- High8.8Authenticated SQL Injection in AOR_Reports (value_type=Field) allows any low-privileged user to read the full databaseOpen the advisoryAug 17, 2026
- Medium6.5AOR Reports aor_fields.field SQL InjectionOpen the advisoryAug 5, 2026
- Medium6.5Authorization Bypass via Document Revision ID Confusion in download.phpOpen the advisoryAug 5, 2026
- High8.3Authenticated SQL Injection In Project ControllerOpen the advisoryAug 5, 2026
- High8.3SQL injection via search param in modules/Cases/controller.phpOpen the advisoryAug 5, 2026
- High8.3SQL injection via get_latest_for_id param in GetLatestRevision.phpOpen the advisoryAug 5, 2026
- Medium6.5SuiteCRM 7 — Record-level Authorization Bypass via AOR_Reports changeReportPageOpen the advisoryJul 31, 2026
- Medium6.5IDOR in generatePdf Entry Point Allows Record Data ExfiltrationOpen the advisoryJul 31, 2026
- High8.3SQL injection via id param in modules/Campaigns/PopupCampaignRoi.phpOpen the advisoryJul 31, 2026
- High8.3Authenticated SQL Injection in get_end_date function in Project ControllerOpen the advisoryJul 31, 2026
- High8.1Incorrect Access Control in V8 relationship creation via missing edit authorizationOpen the advisoryJul 31, 2026
- High7.7isSelfRequest() bypass via substring match allows SSRF to internal servicesOpen the advisoryJul 31, 2026
- High8.3SQL injection via parameter_value[0] param in AOR_Report.phpOpen the advisoryJul 31, 2026
- High7.1SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to…Check if you run itEPSS 0.34%Apr 5, 2026
- High7.1SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the parentTab parameter.Check if you run itEPSS 0.34%Apr 5, 2026
- Critical9.8SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.Check if you run itEPSS 0.69%Mar 20, 2026
- High8.8SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.Check if you run itEPSS 0.45%Mar 20, 2026
- Medium6.5SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application.Check if you run itEPSS 0.29%Mar 20, 2026
Sort